Cookies Policy
This policy explains the cookies and similar technologies FiveStatus uses. There are not many, and there is no consent banner, because we do not set anything that requires one.
What cookies are
A cookie is a small text file a website asks your browser to store and send back on later requests. Cookies are how a site remembers that you are signed in between one page and the next.
A session cookie is deleted when you close your browser. A persistent cookie stays until it expires or you delete it. A first-party cookie is set by the site you are visiting; a third-party cookie is set by another domain, and is what tracking across sites is usually built on.
Public status pages set no cookies
Visiting a public status page — yourserver.fivestatus.com or a custom domain — sets no cookies at all. The page is server-rendered, ships no JavaScript, and does not need to know anything about you. Players visiting a status page are not tracked, by us or by anyone else.
The one exception is if you submit the email subscription form: that request includes a cross-site request forgery token, which is set as a cookie at the moment you submit and exists only to verify that the form came from the page it appears on.
Cookies we set
These apply to this marketing site and to the dashboard at fivestatus.com. All are first-party and strictly necessary.
| Cookie | Purpose | Type | Expires |
|---|---|---|---|
| fivestatus_session | Keeps you signed in and remembers which organisation you are looking at. Without it, every page would ask you to sign in again. | Strictly necessary | 2 hours of inactivity |
| XSRF-TOKEN | Protects against cross-site request forgery — it lets us confirm a form or action was submitted from our own site and not from somewhere else. | Strictly necessary | 2 hours |
| remember_web_* | Set only if you stay signed in, so you do not have to sign in again on every visit. | Strictly necessary | 5 years, or until you sign out |
The session and remember-me cookies are encrypted, marked HttpOnly so page scripts cannot read them, marked Secure so they are only sent over HTTPS, and set with SameSite=Lax so they are not sent on cross-site requests.
Other storage we use
The dashboard is a JavaScript application, and your browser caches its script and stylesheet files in the ordinary way. That is browser caching rather than cookie storage, and it holds no personal data.
We do not use local storage, session storage, IndexedDB, browser fingerprinting, tracking pixels or web beacons to identify you.
What we do not use
- No advertising cookies, and no advertising network of any kind.
- No third-party analytics — no Google Analytics, no Meta Pixel, no equivalents.
- No cross-site tracking, and no sale or sharing of behavioural data.
- No social media embeds that set cookies on our pages.
- No cookies at all on public status pages, as set out in section 2.
We do keep server logs, which record the IP address and browser user agent of requests for security and troubleshooting. Those are not cookies, they are not used to build a profile of you, and their retention is described in our Privacy Policy.
Third-party cookies
We do not embed third-party cookies on FiveStatus pages. However:
- when you sign in with Discord, you are sent to Discord's own site to authorise it, and Discord sets its own cookies there under its own policies;
- if an organisation adds a background image, logo or footer link pointing at another site, your browser will request that resource from that site, which may see your IP address. We provide the controls; the organisation chooses what to put in them;
- following a link from FiveStatus to another Hydra Labs product, or to any other site, takes you outside this policy.
How to control cookies
Every major browser lets you view, block and delete cookies, usually under privacy or site settings. Signing out of FiveStatus clears your session and remember-me cookies.
Because the cookies we set are strictly necessary, blocking them will prevent you from signing in and using the dashboard. It will not affect your ability to read a public status page, which needs no cookies at all.